OWASP REST Security Cheat Sheet

1. HTTPS

   Requiring TLS for REST endpoints.

2. Access Control

   Authorization of API requests.

3. JWT

   Safe use of JSON Web Tokens in REST APIs.

4. API Keys

   API key handling and limits.

5. Restrict HTTP Methods

   Allow-listing methods per endpoint.

6. Out-of-Order API Execution

   Enforcing API call sequences.

7. Input Validation

   Validating parameters, bodies and sizes.

8. Validate Content Types

   Request and response content type handling.

9. Management Endpoints

   Protecting admin and actuator endpoints.

10. Error Handling

    Generic errors without internal detail.

11. Audit Logs

    Logging API access and security events.

12. Security Headers

    Response headers for APIs.

13. CORS

    Cross-origin resource sharing configuration.

14. Sensitive Information in Requests

    Keeping secrets out of URLs and query strings.

15. HTTP Return Codes

    Using appropriate status codes.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.